Searchable encryption management method and device, storage medium and electronic equipment

Abstract

The application provides a searchable encryption management method and device, a storage medium and an electronic device, and relates to the technical field of database encryption access. The method comprises the following steps: receiving a target data request sent by a target device, and determining a database operation required by a proxy server and target data required to be operated based on the target data request; the target device is any one of a cloud server and a user device; performing a data operation corresponding to the database operation on the target data based on the keyword of the target data; wherein the database operation comprises any one of the following: a data initialization operation, a data query operation, a data addition operation, a data deletion operation and a data update operation. The searchable encryption management method and device, the storage medium and the electronic device provided by the application are used for improving the calculation performance, security and access efficiency of searchable encryption.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of database encryption access, and particularly relates to a searchable encryption management method and device, a storage medium and an electronic device. BACKGROUND

[0002] Searchable encryption (SE) is a technology that allows users to perform search operations on encrypted data while ensuring the privacy and security of the data in the unencrypted state. Searchable encryption has important applications in protecting sensitive data (such as medical records, financial information, etc.) and supporting efficient query operations.

[0003] Searchable encryption can be single-user searchable encryption and multi-user searchable encryption according to the key management mode. Single-user searchable encryption scheme is simple and efficient, usually uses symmetric key for encryption and decryption, has small computing overhead, simple algorithm and fast speed, but is limited to single-user access. Multi-user searchable encryption supports fine-grained access control and allows multiple users to access encrypted data. However, since the operation of public key and private key is usually more complex and time-consuming than the operation of symmetric key, the encryption and retrieval efficiency of this scheme is relatively low.

[0004] Therefore, there is an urgent need for a simple and efficient searchable encryption scheme to improve the computing performance, security and access efficiency of searchable encryption. SUMMARY

[0005] The present application provides a searchable encryption management method and device, a storage medium and an electronic device, which can improve the computing performance, security and access efficiency of searchable encryption.

[0006] The present application provides a searchable encryption management method, comprising:

[0007] receiving a target data request sent by a target device, and determining, based on the target data request, a database operation required to be performed by the proxy server and target data on which the operation is required to be performed; the target device is any one of a cloud server and a user device; performing a data operation corresponding to the database operation on the target data based on a keyword of the target data; wherein the database operation comprises any one of a data initialization operation, a data query operation, a data addition operation, a data deletion operation, and a data update operation; the proxy server communicates with a plurality of cloud servers, and the proxy server generates encrypted data stored on each cloud server in the plurality of cloud servers; the encrypted data stored on each cloud server comprises ciphertext data and a corresponding Bloom filter; the Bloom filter corresponding to the ciphertext data is calculated based on a plurality of hash functions; the ciphertext data is generated based on a reserved format encryption algorithm used by the proxy server; the proxy server stores a data encryption and decryption key of each cloud server and a data counter corresponding to each cloud server; the data counter is used to record a total number of rows of the encrypted data stored on each cloud server.

[0008] In this way, the encrypted data stored on each cloud server can be efficiently managed by the proxy server, greatly reducing the computational complexity.

[0009] Optionally, the database operation is a data initialization operation initiated by a target cloud server; the target cloud server is any one of the plurality of cloud servers; the performing of the data operation corresponding to the database operation on the target data based on the keyword of the target data comprises: using a preset keyword extraction algorithm to extract a keyword corresponding to each plaintext data in a plurality of plaintext data contained in the target data, to generate a first data pair; the first data pair comprises plaintext data and a corresponding keyword set; each plaintext data corresponds to at least one keyword; using a reserved format encryption algorithm to generate ciphertext data corresponding to each plaintext data based on a target key and a target counter generated by the proxy server, while using a Bloom filter generation algorithm to generate a Bloom filter corresponding to each plaintext data by taking the keyword set corresponding to each plaintext data as input, to obtain a second data pair corresponding to each data pair; the second data pair comprises ciphertext data and a corresponding Bloom filter; a value of the target counter is used to record an arrangement order of each plaintext data in the plurality of plaintext data; sequentially storing the second data pair of each plaintext data as encrypted data into the target cloud server in order, and storing the target key as the encryption and decryption key of the target cloud server and the target counter as the data counter of the target cloud server into the proxy server.

[0010] Thus, the proxy server completes the initialization operation of the data, and stores the encrypted data to each cloud server, so that subsequent operations such as query, addition, deletion, update, etc. of the encrypted data stored in each cloud server can be facilitated.

[0011] Optionally, the database operation is a data query operation initiated by a target user device; the data operation corresponding to the database operation is performed on the target data based on the keywords of the target data, including: obtaining a first keyword contained in the data requested by the user device to query, and using the first keyword as an input to generate a query vector corresponding to the first keyword using a Bloom filter generation algorithm; the query vector is a multi-dimensional binary vector; the query vector is sent to each cloud server respectively, and query data returned by a target cloud server is received; based on the row number of each data and the data encryption and decryption key corresponding to the target cloud server, a decryption algorithm corresponding to the reserved format encryption algorithm is used to decrypt the encrypted data in the query data to obtain plaintext data, and the plaintext data is sent to the user device; wherein the target cloud server is a cloud server in the plurality of cloud servers that has a Bloom filter matching the query vector; the query data includes at least one encrypted data in the plurality of encrypted data stored in the target cloud server, for which a Bloom filter matches the query vector.

[0012] Thus, the user can retrieve the required information from the plurality of cloud servers according to the keywords, which is convenient, fast and safe.

[0013] Optionally, the database operation is a data addition operation initiated by a target user device; the data operation corresponding to the database operation is performed on the target data based on the keywords of the target data, including: obtaining at least one data added to a target cloud server, and using a preset keyword extraction algorithm to extract keywords corresponding to each plaintext data in the at least one data to generate a third data pair; the third data pair includes plaintext data and a corresponding keyword set; each plaintext data corresponds to at least one keyword; based on the data encryption and decryption key of the target cloud server and the data counter, a reserved format encryption algorithm is used to generate ciphertext data corresponding to each plaintext data, and at the same time, the keyword set corresponding to each plaintext data is used as an input to generate a Bloom filter corresponding to each plaintext data using a Bloom filter generation algorithm, and a fourth data pair corresponding to each data is obtained; the fourth data pair includes ciphertext data and a corresponding Bloom filter; after the encrypted data stored in the target cloud server, the fourth data pair of each plaintext data is sequentially stored as encrypted data in the target cloud server in order.

[0014] Thus, the encrypted data is added to the encrypted data stored in the corresponding cloud server by the proxy server, and since the stored encrypted data is not operated, it is more convenient and efficient.

[0015] Optionally, the database operation is a data deletion operation initiated by the target user equipment; the data operation corresponding to the database operation is performed on the target data based on the keywords of the target data, including: obtaining second keywords contained in the data requested to be deleted by the user equipment, and generating a deletion vector using a Bloom filter generation algorithm with the second keywords as the input; the deletion vector is a multi-dimensional binary vector; the deletion vector is sent to each cloud server respectively; the target cloud server is a cloud server in the plurality of cloud servers that has a Bloom filter matching the query vector; after receiving the deletion vector, the target cloud server sets the values of the Bloom filters matching the deletion vector among the plurality of encrypted data stored in the target cloud server to 0.

[0016] Thus, when performing the data deletion operation, the deleted data is directly overwritten with a random number, so the integrity of the data is not damaged, and the execution efficiency of the deletion operation is high.

[0017] Optionally, the database operation is a data update operation performed by the proxy server and the cloud server; the data operation corresponding to the database operation is performed on the target data based on the keywords of the target data, including: obtaining a plurality of ciphertext data sent by the target cloud server and an old key corresponding to the target cloud server; generating a new key and a new counter corresponding to the target cloud server, and decrypting the plurality of ciphertext data using the old key; the target cloud server is a cloud server in the plurality of cloud servers that needs to perform data update; when decrypting, if the Bloom filter of the encrypted data is empty, the plaintext data of the encrypted data is set to empty; if the current plaintext data is not empty, the current plaintext data is encrypted using a reserved format encryption algorithm based on the new key, and a set of keywords corresponding to the current plaintext data is used as input to generate a Bloom filter corresponding to the current plaintext data using a Bloom filter generation algorithm, and the new counter is updated; each plaintext data is stored in the target cloud server in sequence, and the new key is stored in the proxy server as the encryption and decryption key of the target cloud server, and the new counter is stored in the proxy server as the data counter of the target cloud server.

[0018] Thus, when the deleted data is more, these data still occupies the storage space, and affects the retrieval efficiency, and in order to improve the data security, the data needs to be updated regularly, and the useless data is deleted while the data is re-encrypted.

[0019] Optionally, the Bloom filter generation algorithm comprises: initializing a row number counter and a multi-dimensional binary vector; the multi-dimensional binary vector is used to represent a plurality of parameter values corresponding to the row number of each row of data; the dimension of the multi-dimensional binary vector is the same as the number of rows of data stored on the cloud server; the number of parameter values corresponding to the row number of each row of data is the same as the number of keywords of the ciphertext data corresponding to the row number; the value of the current row number counter and the currently calculated keyword are sequentially input into the plurality of hash functions for or operation to obtain a result value corresponding to each hash function; the value of the row number counter is obtained by accumulating calculation based on the row number of each row of data; after adjusting the parameter values in the multi-dimensional binary vector according to a preset assignment algorithm, a vector composed of a plurality of parameter values corresponding to each row number is obtained; wherein the preset assignment algorithm comprises: if there is a target parameter value in the plurality of parameter values corresponding to the row number, the number of the target parameter value is the same as the result value corresponding to any hash function in the plurality of hash functions, and the target parameter value is 0, then the target parameter value is assigned as 1.

[0020] Thus, by using the above Bloom filter generation algorithm, the encrypted data corresponding to the plaintext data can be quickly calculated, and the execution efficiency of the data query, addition, deletion, update and other operations is greatly improved.

[0021] The application further provides a searchable encryption management device, comprising:

[0022] The receiving module is configured to receive a target data request sent by a target device; the determining module is configured to determine, based on the target data request, a database operation required to be performed by the proxy server and target data required to be operated; the target device is any one of a cloud server and a user device; the data operation module is configured to perform a data operation corresponding to the database operation on the target data based on a keyword of the target data; wherein the database operation includes any one of the following: a data initialization operation, a data query operation, a data addition operation, a data deletion operation, and a data update operation; the proxy server communicates with a plurality of cloud servers, and the proxy server generates encrypted data stored on each cloud server in the plurality of cloud servers; the encrypted data stored on each cloud server includes: ciphertext data and a corresponding Bloom filter; the Bloom filter corresponding to the ciphertext data is calculated based on a plurality of hash functions; the ciphertext data is generated based on a reserved format encryption algorithm used by the proxy server; the proxy server stores: a data encryption and decryption key of each cloud server and a data counter corresponding to each cloud server; the data counter is used to record the total number of rows of the encrypted data stored on each cloud server.

[0023] Optionally, the database operation is a data initialization operation initiated by a target cloud server; the target cloud server is any one of the plurality of cloud servers; the data operation module is specifically configured to extract a keyword corresponding to each plaintext data in a plurality of plaintext data included in the target data using a preset keyword extraction algorithm to generate a first data pair; the first data pair includes: plaintext data and a corresponding keyword set; each plaintext data corresponds to at least one keyword; the data operation module is specifically further configured to generate, based on a target key and a target counter generated by the proxy server, ciphertext data corresponding to each plaintext data using a reserved format encryption algorithm, and simultaneously, using a Bloom filter generation algorithm, generate a Bloom filter corresponding to each plaintext data by taking the keyword set corresponding to each plaintext data as input, and obtain a second data pair corresponding to each data pair; the second data pair includes: ciphertext data and a corresponding Bloom filter; the value of the target counter is used to record the arrangement order of each plaintext data in the plurality of plaintext data; the data operation module is specifically further configured to sequentially store, in order, the second data pair of each plaintext data as encrypted data into the target cloud server, and store the target key as the encryption and decryption key of the target cloud server and the target counter as the data counter of the target cloud server into the proxy server.

[0024] Optionally, the database operation is a data query operation initiated by a target user device; the data operation module is specifically configured to obtain a first keyword contained in data requested by the user device to query, and generate a query vector corresponding to the first keyword using a Bloom filter generation algorithm with the first keyword as input; the query vector is a multi-dimensional binary vector; the receiving module is further configured to send the query vector to each cloud server respectively, and receive query data returned by a target cloud server; the data operation module is specifically further configured to decrypt encrypted data in the query data using a decryption algorithm corresponding to the reserved format encryption algorithm based on a row number of each data and a data encryption and decryption key corresponding to the target cloud server, to obtain plaintext data, and send the plaintext data to the user device; wherein the target cloud server is a cloud server in the plurality of cloud servers that has a Bloom filter matching the query vector; the query data includes at least one encrypted data in a plurality of encrypted data stored in the target cloud server, for which a Bloom filter matches the query vector.

[0025] Optionally, the database operation is a data query operation initiated by a target user device; the data operation module is specifically configured to obtain a first keyword contained in data requested by the user device to query, and generate a query vector corresponding to the first keyword using a Bloom filter generation algorithm with the first keyword as input; the query vector is a multi-dimensional binary vector; the receiving module is further configured to send the query vector to each cloud server respectively, and receive query data returned by a target cloud server; the data operation module is specifically further configured to decrypt encrypted data in the query data using a decryption algorithm corresponding to the reserved format encryption algorithm based on a row number of each data and a data encryption and decryption key corresponding to the target cloud server, to obtain plaintext data, and send the plaintext data to the user device; wherein the target cloud server is a cloud server in the plurality of cloud servers that has a Bloom filter matching the query vector; the query data includes at least one encrypted data in a plurality of encrypted data stored in the target cloud server, for which a Bloom filter matches the query vector.

[0026] Optionally, the database operation is a data deletion operation initiated by the target user device; the data operation module is specifically configured to acquire a second keyword contained in the data requested to be deleted by the user device, and generate a deletion vector using the Bloom filter generation algorithm with the second keyword as an input; the deletion vector is a multi-dimensional binary vector; the data operation module is specifically further configured to send the deletion vector to each cloud server respectively; the target cloud server is a cloud server in the plurality of cloud servers that has a Bloom filter matching the query vector; after receiving the deletion vector, the target cloud server sets the values of the Bloom filters matching the deletion vector among the plurality of encrypted data stored in the target cloud server to 0.

[0027] Optionally, the database operation is a data update operation performed by the proxy server and the cloud server jointly; the data operation module is specifically configured to acquire a plurality of ciphertext data sent by a target cloud server and an old key corresponding to the target cloud server; the data operation module is specifically further configured to generate a new key and a new counter corresponding to the target cloud server, and decrypt the plurality of ciphertext data using the old key; the target cloud server is a cloud server in the plurality of cloud servers that needs to perform data update; when decrypting, if the Bloom filter of the encrypted data is empty, the plaintext data of the encrypted data is set to empty; the data operation module is specifically further configured to, if the current plaintext data is not empty, encrypt the current plaintext data using the reserved format encryption algorithm based on the new key, generate a Bloom filter corresponding to the current plaintext data using the Bloom filter generation algorithm with the keyword set corresponding to the current plaintext data as an input, and update the new counter; the data operation module is specifically further configured to sequentially store the encrypted data of each plaintext data into the target cloud server in order, and store the new key as the encryption and decryption key of the target cloud server and the new counter as the data counter of the target cloud server into the proxy server.

[0028] Optionally, the data operation module is specifically configured to initialize a row number counter and a multi-dimensional binary vector; the multi-dimensional binary vector is used to represent a plurality of parameter values corresponding to a row number of each row of data; a dimension of the multi-dimensional binary vector is the same as a number of rows of data stored on the cloud server; a number of parameter values corresponding to the row number of each row of data is the same as a number of keywords of the ciphertext data corresponding to the row number; the data operation module is further configured to sequentially input a value of the current row number counter and a currently calculated keyword into the plurality of hash functions to perform an OR operation, to obtain a result value corresponding to each hash function; the value of the row number counter is obtained based on an accumulated calculation of the row number of each row of data; and the data operation module is further configured to obtain a vector composed of a plurality of parameter values corresponding to each row number after adjusting the parameter values in the multi-dimensional binary vector according to a preset assignment algorithm; wherein the preset assignment algorithm comprises: if there is a target parameter value in the plurality of parameter values corresponding to the row number, the target parameter value has a parameter value number same as the result value corresponding to any hash function of the plurality of hash functions, and the target parameter value is 0, then the target parameter value is assigned as 1.

[0029] The application further provides a computer program product comprising computer programs / instructions which, when executed by a processor, implement the steps of the searchable encryption management method according to any one of the above.

[0030] The application further provides an electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor implements the steps of the searchable encryption management method according to any one of the above when executing the program.

[0031] The application further provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the searchable encryption management method according to any one of the above.

[0032] The searchable encryption management method, device, storage medium and electronic equipment provided by the application are applied to a proxy server in a searchable encryption management system, the searchable encryption management system further comprising a cloud server for storing encrypted data and a user device. First, a target data request sent by a target device is received, and database operations required to be performed by the proxy server and target data required to be operated are determined based on the target data request; the target device is any of the cloud server and the user device; then, data operations corresponding to the database operations are performed on the target data based on keywords of the target data; wherein the database operations include any of the following: data initialization operation, data query operation, data addition operation, data deletion operation and data update operation; the proxy server communicates with a plurality of cloud servers, and the proxy server generates encrypted data stored on each cloud server in the plurality of cloud servers; the encrypted data stored on each cloud server includes ciphertext data and a corresponding Bloom filter; the Bloom filter corresponding to the ciphertext data is calculated based on a plurality of hash functions; the ciphertext data is generated based on a reserved format encryption algorithm used by the proxy server; the proxy server stores a data encryption and decryption key of each cloud server and a data counter corresponding to each cloud server; the data counter is used to record the total number of rows of the encrypted data stored on each cloud server. BRIEF DESCRIPTION OF DRAWINGS

[0033] In order to more clearly illustrate the technical solutions in the application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are some embodiments of the application, and other drawings can also be obtained by those skilled in the art without creative labor.

[0034] Figure 1 is a system architecture schematic diagram of the searchable encryption management system provided by the application;

[0035] Figure 2 is a flowchart of the searchable encryption management method provided by the application;

[0036] Figure 3 is a structure schematic diagram of the searchable encryption management device provided by the application;

[0037] Figure 4 is a structure schematic diagram of the electronic equipment provided by the application. DETAILED DESCRIPTION

[0038] In order to make the purposes, technical solutions and advantages of the present application clearer, the technical solutions in the present application will be described clearly and completely below in conjunction with the drawings in the present application. Obviously, the described embodiments are some of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of protection of the present application.

[0039] The terms "first", "second", and the like in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described herein, and the objects distinguished by "first", "second", etc. are generally a category and do not limit the number of objects, for example, the first object can be one or more. In addition, "and / or" in the specification and claims indicates at least one of the connected objects, and the character " / ", generally indicates that the objects before and after are in a "or" relationship.

[0040] The searchable encryption scheme in the related art mainly has the following technical problems: ①, performance problem: the searchable encryption scheme supporting complex functions often needs to use homomorphic encryption, public key cryptography, etc., usually involving complex cryptographic operations, and the efficiency is low. ②, user management is complex: in the searchable encryption scheme, how to control the access of users is a key problem. Especially in a multi-user environment, fine-grained access authorization needs to be implemented to ensure secure sharing and retrieval of data. ③, security problem: many public key searchable encryption schemes still fail to effectively cope with the potential threat of keyword guessing attacks. Attackers may efficiently recover the query keyword by observing the number of encrypted files returned by the search result with known keywords. ④, limited query function: many schemes sacrifice efficiency or security to improve query expression capability, and it is difficult to balance between query function diversity and efficiency or security.

[0041] In view of the above technical problems in the related art, as shown in Figure 1 The embodiments of the present application provide a searchable encryption management system, which comprises a proxy server, a cloud server for storing encrypted data, and a user device. The cloud server is used to store database encrypted data and feedback data operation requests of the proxy server (the proxy server is a trusted proxy server). The proxy server completes the initialization, query, addition, deletion, update and other operations of the data in the database by communicating with the cloud server, and uses an access control strategy to manage the access rights of multiple users. The user device accesses the database through the proxy server to obtain the required services.

[0042] With reference to the accompanying drawings, the searchable encryption management method provided by the embodiments of the present application will be described in detail below in conjunction with specific examples and application scenarios.

[0043] As shown in the figure, the searchable encryption management method provided by the embodiments of the present application can include the following steps 201 and 203: Figure 2

[0044] Step 201, receiving a target data request sent by a target device, and determining a database operation required to be performed by the proxy server and target data required to be operated based on the target data request.

[0045] Among them, the target device is any one of a cloud server and a user device.

[0046] It can be understood that in the embodiments of the present application, the database operation includes any one of the following: a data initialization operation performed by the cloud server and the proxy server together, a data query operation performed by the user device, the proxy server and the cloud server together, a data addition operation performed by the user device, the proxy server and the cloud server together, a data deletion operation performed by the user device, the proxy server and the cloud server together, and a data update operation performed by the proxy server and the cloud server together.

[0047] For example, the above-mentioned data initialization operation is mainly used for storing the ciphertext data in the cloud server after encrypting the plaintext data; the above-mentioned data query operation is mainly used for the user device to query the encrypted data stored in the cloud server through the proxy server; the above-mentioned data addition operation is mainly used for adding the ciphertext data to the cloud server; the above-mentioned data deletion operation is mainly used for deleting the ciphertext data in the cloud server; and the above-mentioned data update operation is mainly used for clearing the deleted ciphertext data in the cloud server, thereby improving the utilization rate of the storage space.

[0048] Step 202, performing a data operation corresponding to the database operation on the target data based on the keyword of the target data.

[0049] Among them, the proxy server communicates with a plurality of cloud servers, and the proxy server generates encrypted data stored on each cloud server in the plurality of cloud servers; the encrypted data stored on each cloud server includes ciphertext data and a corresponding Bloom filter; the Bloom filter corresponding to the ciphertext data is calculated based on a plurality of hash functions; the plurality of ciphertext data is generated based on a reserved format encryption algorithm used by the proxy server; the proxy server stores a data encryption and decryption key of each cloud server and a data counter corresponding to each cloud server; the data counter is used to record the total number of rows of the encrypted data stored on each cloud server. ​

[0050] Exemplarily, in the embodiments of the present application, the storage and query of data are mainly performed by the Bloom filter generated by the keywords. The keywords are obtained by keyword extraction from the plaintext data or provided by the user equipment when deleting the data; and the Bloom filter is generated by the Bloom filter generation algorithm provided by the embodiments of the present application. The Bloom filter generation algorithm mainly uses the input keywords and a plurality of hash functions generated based on the reservation format encryption algorithm used by the proxy server to obtain the corresponding Bloom filter.

[0051] It should be noted that the Bloom filter (BF) is a kind of probability data structure with extremely high space efficiency, which can be used to test whether an element is a member of a set. When the BF judges that an element is in the set, there is a certain false negative rate, and when the BF judges that an element is not in the set, the element must not be in the set. The probability of false judgment of the Bloom filter is wherein, represents the number of data stored in the Bloom filter (corresponding to the present scheme, i.e. the number of keywords of each data), represents the length of the Bloom filter, represents the number of hash functions.

[0052] Optionally, the above database operation can be a data initialization operation initiated by a target cloud server; and the target cloud server is any one of the plurality of cloud servers.

[0053] Specifically, the above step 202 can further include the following steps 202a1 to 202a3:

[0054] Step 202a1, using a preset keyword extraction algorithm to extract the keywords corresponding to each plaintext data in the plurality of plaintext data contained in the target data, to generate a first data pair.

[0055] Wherein, the first data pair includes: plaintext data and a corresponding keyword set; each plaintext data corresponds to at least one keyword.

[0056] Step 202a2, based on the target key and the target counter generated by the proxy server, using the reservation format encryption algorithm to generate the ciphertext data corresponding to each plaintext data, and at the same time, using the Bloom filter generation algorithm to generate the Bloom filter corresponding to each plaintext data with the keyword set corresponding to each plaintext data as input, and obtaining the second data pair corresponding to each data.

[0057] Wherein, the second data pair includes: ciphertext data and a corresponding Bloom filter; the value of the target counter is used to record the arrangement order of each plaintext data in the plurality of plaintext data.

[0058] Step 202a3, sequentially store each second data pair of the plaintext data as encrypted data into the target cloud server, and store the target key as the encryption and decryption key of the target cloud server, and the target counter as the data counter of the target cloud server into the proxy server.

[0059] For example, the proxy server completes data initialization and stores ciphertext data in the cloud server, and the specific steps are as follows:

[0060] ①Suppose there are pieces of data in the database of the cloud server, denoted as (i.e., the above multiple plaintext data).

[0061] ②The proxy server extracts the keywords of each piece of data in turn through a keyword extraction algorithm, generates a data-keyword set pair (i.e., the above first data pair), and records each data pair as . Wherein, represents the keyword set , represents the number of keywords extracted from the data .

[0062] It should be noted that there are many ways to extract keywords, such as rule-based, word segmentation, machine learning, etc., and the specific extraction algorithm is determined by the actual application scenario.

[0063] ③The proxy server selects a reserved format encryption algorithm and the corresponding decryption algorithm , which is used to generate a hash function of the Bloom filter (i.e., the above multiple hash functions), and the output space of the hash function is , wherein represents the vector length of the Bloom filter.

[0064] ④The proxy server generates data encryption and decryption keys and data counters , and keyword counters for processing keywords .

[0065] ⑤For any plaintext data , the proxy server uses the reserved format encryption algorithm to encrypt it, and records the corresponding ciphertext data as , that is, , wherein, . The initial value of COUNTER is a random number generated together with KEY in step ④.

[0066] ⑥For any plaintext data The keyword set extracted by the keyword extraction algorithm is: The proxy server generates a Bloom filter using a Bloom filter generation algorithm The specific process is as follows:

[0067] a, initialization vector dimension two binary vector .

[0068] b, for each keyword of the plaintext data , , in turn , where If , let , where .

[0069] ⑦, the Bloom filter and the plaintext data pair are stored in the cloud server in order, and the number of rows corresponding to each row of data is . The Bloom filter and the plaintext data pair are the second data pair described above.

[0070] ⑧, the proxy server stores data encryption and decryption keys , data counters , keyword counters and the total number of data .

[0071] It should be noted that the data can be stored in multiple cloud servers, and only one counter for each server needs to be set and stored in the proxy server.

[0072] Optionally, the above database operation can also be a data query operation initiated by a target user device.

[0073] Specifically, the above step 202 can also include the following steps 202b1 to 202b3:

[0074] Step 202b1, obtain the first keyword contained in the data requested by the user device for query, and generate a query vector corresponding to the first keyword using a Bloom filter generation algorithm based on the first keyword and the plurality of hash functions.

[0075] Wherein, the query vector is: a multi-dimensional binary vector.

[0076] Step 202b2, send the query vector to each cloud server respectively, and receive the query data returned by the target cloud server.

[0077] Step 202b3, based on the line number of each data and the data encryption and decryption key corresponding to the target cloud server, using the decryption algorithm corresponding to the reserved format encryption algorithm to decrypt the encrypted data in the query data, obtaining the plaintext data, and sending the plaintext data to the user equipment;

[0078] Wherein, the target cloud server is a cloud server in the plurality of cloud servers that has a Bloom filter matching the query vector; the query data includes at least one encrypted data whose Bloom filter matches the query vector in the plurality of encrypted data stored in the target cloud server.

[0079] For example, the user equipment completes the query of encrypted data through the proxy server, and the specific steps are as follows:

[0080] 1. Set the user query keyword as (i.e. the first keyword), and send to the proxy server.

[0081] 2. The proxy server generates a query vector according to , and the specific process is as follows:

[0082] a. Initialize the vector to a binary vector .

[0083] b. For the input target keyword, it is necessary to calculate in turn, where . If , let , where .

[0084] c. Send (i.e. the query vector corresponding to the first keyword, wherein the query vector contains a plurality of vectors, and the total number of vectors is the same as the total number of ciphertext data stored on the target cloud server) to the cloud server.

[0085] d. The cloud server retrieves the ciphertext database, and if , returns the data to the proxy server.

[0086] e. Set the data returned by the cloud server to the proxy server as , where represents the total number of returned data. The proxy server decrypts each data in turn , where . And send the decrypted data to the user.

[0087] It should be noted that the proxy server can send a fixed number of search vectors to the cloud server each time until the required search information is obtained. Search can be performed simultaneously to multiple cloud servers, and the counter used when returning data decryption is the counter corresponding to the server. Support multi-keyword search and support keyword logical operation. For example, if the data of the keywords and exist at the same time, the search vector and are generated according to the keywords respectively, is calculated, and search is performed using .

[0088] Optionally, the above database operation can also be a data addition operation initiated by the target user equipment.

[0089] Specifically, the above step 202 can further include the following steps 202c1-202c3:

[0090] Step 202c1, obtain at least one data added to the target cloud server, and use a preset keyword extraction algorithm to extract the keywords corresponding to each plaintext data in the at least one data to generate a third data pair.

[0091] Among them, the third data pair includes: plaintext data and a corresponding keyword set, each plaintext data corresponds to at least one keyword.

[0092] Step 202c2, based on the data encryption and decryption key and the data counter of the target cloud server, using the reserved format encryption algorithm to generate the ciphertext data corresponding to each plaintext data, and at the same time, using the Bloom filter generation algorithm to generate the Bloom filter corresponding to each plaintext data, and obtaining the fourth data pair corresponding to each data.

[0093] Among them, the fourth data pair includes: ciphertext data and a corresponding Bloom filter.

[0094] Step 202c3, after storing the encrypted data in the target cloud server, sequentially store the fourth data pair of each plaintext data as encrypted data in the target cloud server in order.

[0095] For example, the user equipment completes the data addition operation through the proxy server, which is similar to the data initialization process, the difference is that the data addition operation adds the ciphertext data to the back of the existing ciphertext database, and the specific process is as follows:

[0096] ①, suppose the user adds data (i.e. the above at least one data) to the database, denoted as .

[0097] ② The proxy server uses a keyword extraction algorithm to extract keywords from each piece of data sequentially, generating data-keyword sets (i.e., the third data pair mentioned above), and denoted as... ,in, Represents a set of keywords , Indicates from data The number of keywords extracted.

[0098] ③ For any data The proxy server encrypts it using a format-preserving encryption algorithm, and the corresponding ciphertext is denoted as . ,Right now ,in, ,in This represents the number of data entries currently stored in the cloud server.

[0099] ④ For any data The set of corresponding keywords extracted by the preset keyword extraction algorithm is The proxy service uses a Bloom filter generation algorithm to generate Bloom filters. The specific process is as follows:

[0100] a. Initialization vector 2D binary vector ;

[0101] b. For each keyword , Calculate in sequence ,in .like Then let ,in .

[0102] ⑤ Compare the encrypted data with the Bloom filter Add the data to the cloud server sequentially, with each row corresponding to a specific number of rows. .

[0103] It should be noted that data updates can be completed in parallel across multiple cloud servers. When updating each server, you only need to use the counter corresponding to that server.

[0104] Optionally, the above database operation can also be a data deletion operation initiated by the target user device.

[0105] Specifically, step 202 above may also include the following steps 202d1 and 202d2:

[0106] Step 202d1: Obtain the second keyword contained in the data requested for deletion by the user equipment, and use the second keyword as a basis to generate a deletion vector using a Bloom filter algorithm.

[0107] The deletion vector is a multidimensional binary vector.

[0108] Step 202d2: Send the deletion vector to each cloud server respectively.

[0109] The target cloud server is a cloud server among the plurality of cloud servers that has a Bloom filter that matches the query vector; after receiving the deletion vector, the target cloud server sets the value of the Bloom filter that matches the deletion vector in the plurality of encrypted data stored in the target cloud server to 0.

[0110] For example, when a user device completes a data deletion operation through a proxy server, it is similar to the data query process, except that when deleting data, the queried data is overwritten with random data. The specific process is as follows:

[0111] ① Suppose a user requests the deletion of a file containing the keyword. The data will Send to the proxy server.

[0112] ② The proxy server is based on The process of generating query vectors is as follows:

[0113] a. Initialization vector 2D binary vector .

[0114] b. Calculate sequentially ,in .like Then let ,in .

[0115] c. Send to the cloud server.

[0116] d. The cloud server retrieves the encrypted database. Then Set it to an all-zero vector, and then set the data... Overwrite with random data in the same format.

[0117] It should be noted that data deletion operations can be performed on multiple cloud servers simultaneously. When deleting data on each server, a search vector is generated using the corresponding server's counter. Multi-keyword deletion is supported, as well as keyword logical operations. For example, if multiple keywords exist simultaneously, the deletion operation can be performed. and If the data is not the same as the data in the data set, the search vector is generated according to the keyword And , the calculation , send to the cloud server for deletion operation.

[0118] Optionally, since the deleted data is filled with random numbers after data deletion, when there is a large amount of deleted data, these data still occupy storage space and affect search efficiency, and in order to improve data security, data needs to be updated regularly to delete useless data while re-encrypting the data.

[0119] Specifically, the above step 202 can further include the following steps 202e1 to 202e4:

[0120] Step 202e1, obtaining a plurality of ciphertext data sent by a target cloud server and an old key corresponding to the target cloud server.

[0121] Step 202e2, generating a new key and a new counter corresponding to the target cloud server, and decrypting the plurality of ciphertext data using the old key.

[0122] Wherein, the target cloud server is a cloud server in the plurality of cloud servers that needs to update data; when decrypting, if the Bloom filter of the encrypted data is null, the plaintext data of the encrypted data is set to null.

[0123] Step 202e3, if the current plaintext data is not null, encrypting the current plaintext data using a reserved format encryption algorithm based on the new key, and generating a Bloom filter corresponding to the current plaintext data using a Bloom filter generation algorithm with the keyword set corresponding to the current plaintext data as input, and updating the new counter.

[0124] Step 202e4, sequentially storing the encrypted data of each plaintext data into the target cloud server, and storing the new key as the encryption and decryption key of the target cloud server and the new counter as the data counter of the target cloud server into the proxy server.

[0125] For example, data update is completed by the proxy server and the cloud server, and the specific process is as follows:

[0126] ①, the proxy server generates a new data encryption and decryption key And data counter , and a counter for processing keywords , and let .

[0127] ​

[0128]

[0129]

[0130]

[0131]

[0132]

[0133]

[0134]

[0135]

[0136] ​​​​​​​​​​​​​​​​​​​​​​​​​​​​​The searchable encryption management method provided in the embodiments of the present application uses a proxy server to complete database searchable encryption, deploys a user access control mechanism on the proxy server, and can realize multi-user searchable encryption. The data ciphertext is stored in the cloud server. Since a reserved format encryption scheme is used, database encryption can be realized without modifying the database. The keyword information is stored using a Bloom filter, and fuzzy searchable is realized in combination with a keyword extraction strategy. Multi-keyword query is supported, and keyword logical operation query is supported.

[0137] The searchable encryption management method provided in the embodiments of the present application is applied to a proxy server in a searchable encryption management system, and the searchable encryption management system further includes a cloud server for storing encrypted data and a user device. First, a target data request sent by a target device is received, and a database operation required to be performed by the proxy server and target data required to be operated are determined based on the target data request; the target device is any one of the cloud server and the user device; then, a data operation corresponding to the database operation is performed on the target data based on a keyword of the target data; wherein the database operation includes any one of the following: data initialization operation, data query operation, data addition operation, data deletion operation and data update operation; the proxy server communicates with a plurality of cloud servers, and the proxy server generates encrypted data stored on each cloud server in the plurality of cloud servers; the encrypted data stored by each cloud server includes ciphertext data and a corresponding Bloom filter; the Bloom filter corresponding to the ciphertext data is calculated based on a plurality of hash functions; the ciphertext data is generated based on a reserved format encryption algorithm used by the proxy server; the proxy server stores a data encryption and decryption key of each cloud server and a data counter corresponding to each cloud server; the data counter is used to record the total number of rows of the encrypted data stored by each cloud server.

[0138] It should be noted that the searchable encryption management method provided in the embodiments of the present application can be executed by a searchable encryption management device or a control module in the searchable encryption management device for executing the searchable encryption management method. In the embodiments of the present application, the searchable encryption management device executes the searchable encryption management method as an example, and the searchable encryption management device provided in the embodiments of the present application is described.

[0139] It should be noted that the searchable encryption management method provided in the embodiments of the present application can be executed by a searchable encryption management device or a control module in the searchable encryption management device for executing the searchable encryption management method. In the embodiments of the present application, the searchable encryption management device executes the searchable encryption management method as an example, and the searchable encryption management device provided in the embodiments of the present application is described.

[0140] The searchable encryption management device provided in the present application is described below, and the searchable encryption management method described below can be correspondingly referred to the searchable encryption management method described above.

[0141] Figure 3 The structure diagram of the searchable encryption management device provided in the embodiments of the present application is shown in FIG. 1, which specifically includes: Figure 3

[0142] The receiving module 301 is configured to receive a target data request sent by a target device; the determining module 302 is configured to determine, based on the target data request, a database operation required to be performed by the proxy server and target data required to be operated; the target device is any one of a cloud server and a user device; the data operation module 303 is configured to perform, based on a keyword of the target data, a data operation corresponding to the database operation on the target data; wherein the database operation includes any one of the following: a data initialization operation, a data query operation, a data addition operation, a data deletion operation and a data update operation; the proxy server communicates with a plurality of cloud servers, and the proxy server generates encrypted data stored on each cloud server in the plurality of cloud servers; the encrypted data stored on each cloud server includes: ciphertext data and a corresponding Bloom filter; the Bloom filter corresponding to the ciphertext data is calculated based on a plurality of hash functions; the ciphertext data is generated based on a reserved format encryption algorithm used by the proxy server; the proxy server stores a data encryption and decryption key of each cloud server and a data counter corresponding to each cloud server; the data counter is used to record the total number of rows of the encrypted data stored on each cloud server.

[0143] ​Optionally, the database operation is a data initialization operation initiated by a target cloud server; the target cloud server is any one of the plurality of cloud servers; the data operation module 303 is specifically configured to extract a keyword corresponding to each plaintext data in a plurality of plaintext data contained in the target data using a preset keyword extraction algorithm, and generate a first data pair; the first data pair includes: plaintext data and a corresponding keyword set; each plaintext data corresponds to at least one keyword; the data operation module 303 is specifically further configured to generate a ciphertext data corresponding to each plaintext data using a reserved format encryption algorithm based on a target key and a target counter generated by the proxy server, and simultaneously, using a Bloom filter generation algorithm, generate a Bloom filter corresponding to each plaintext data by taking the keyword set corresponding to each plaintext data as input, and obtain a second data pair corresponding to each data pair; the second data pair includes: ciphertext data and a corresponding Bloom filter; the value of the target counter is used to record the arrangement order of each plaintext data in the plurality of plaintext data; the data operation module 303 is specifically further configured to sequentially store the second data pair of each plaintext data as encrypted data in the target cloud server in order, and store the target key as the encryption and decryption key of the target cloud server and the target counter as the data counter of the target cloud server in the proxy server.

[0144] Optionally, the database operation is a data query operation initiated by a target user equipment; the data operation module 303 is specifically configured to obtain a first keyword contained in the data requested by the user equipment to query, and generate a query vector corresponding to the first keyword using a Bloom filter generation algorithm by taking the first keyword as input; the query vector is a multi-dimensional binary vector; the receiving module 301 is further configured to send the query vector to each cloud server respectively, and receive query data returned by a target cloud server; the data operation module 303 is specifically further configured to decrypt the encrypted data in the query data using a decryption algorithm corresponding to the reserved format encryption algorithm based on the row number of each data and the data encryption and decryption key corresponding to the target cloud server, to obtain plaintext data, and send the plaintext data to the user equipment; wherein the target cloud server is a cloud server in the plurality of cloud servers that has a Bloom filter matching the query vector; the query data includes at least one encrypted data whose Bloom filter matches the query vector in a plurality of encrypted data stored in the target cloud server.

[0145] Optionally, the database operation is a data addition operation initiated by the target user equipment; the data operation module 303 is specifically configured to obtain at least one data added to the target cloud server, and extract a keyword corresponding to each plaintext data in the at least one data using a preset keyword extraction algorithm to generate a third data pair; the third data pair includes plaintext data and a corresponding keyword set; each plaintext data corresponds to at least one keyword; the data operation module 303 is specifically further configured to generate a ciphertext data corresponding to each plaintext data using a reserved format encryption algorithm based on a data encryption and decryption key and a data counter of the target cloud server, and simultaneously generate a Bloom filter corresponding to each plaintext data using a Bloom filter generation algorithm by taking the keyword set corresponding to each plaintext data as input, and obtain a fourth data pair corresponding to each data; the fourth data pair includes ciphertext data and a corresponding Bloom filter; the data operation module 303 is specifically further configured to store the fourth data pair of each plaintext data as encrypted data to the target cloud server in sequence after the encrypted data stored in the target cloud server.

[0146] Optionally, the database operation is a data deletion operation initiated by the target user equipment; the data operation module 303 is specifically configured to obtain a second keyword contained in the data requested to be deleted by the user equipment, and generate a deletion vector using a Bloom filter generation algorithm by taking the second keyword as input; the deletion vector is a multi-dimensional binary vector; the data operation module 303 is specifically further configured to send the deletion vector to each cloud server respectively; wherein the target cloud server is a cloud server in the plurality of cloud servers that has a Bloom filter matching the query vector; after receiving the deletion vector, the target cloud server sets the value of the Bloom filter matching the deletion vector among the plurality of encrypted data stored in the target cloud server to 0.

[0147] Optionally, the database operation is a data updating operation performed by the proxy server and the cloud server jointly; the data operation module 303 is specifically configured to acquire a plurality of ciphertext data sent by a target cloud server and an old key corresponding to the target cloud server; the data operation module 303 is further configured to generate a new key and a new counter corresponding to the target cloud server, and decrypt the plurality of ciphertext data using the old key; the target cloud server is a cloud server in the plurality of cloud servers that needs to perform data updating; when decrypting, if a Bloom filter of encrypted data is a null value, plaintext data of the encrypted data is set as a null value; the data operation module 303 is further configured to, if the current plaintext data is not a null value, encrypt the current plaintext data using a reserved format encryption algorithm based on the new key, use a Bloom filter generation algorithm to generate a Bloom filter corresponding to the current plaintext data by taking a keyword set corresponding to the current plaintext data as input, and update the new counter; the data operation module 303 is further configured to sequentially store encrypted data of each plaintext data into the target cloud server in order, and store the new key as an encryption and decryption key of the target cloud server and the new counter as a data counter of the target cloud server into the proxy server.

[0148] Optionally, the data operation module 303 is specifically configured to initialize a row number counter and a multi-dimensional binary vector; the multi-dimensional binary vector is used to represent a plurality of parameter values corresponding to a row number of each row of data; a dimension of the multi-dimensional binary vector is the same as a number of rows of data stored on a cloud server; a number of parameter values corresponding to a row number of each row of data is the same as a number of keywords of ciphertext data corresponding to the row number; the data operation module 303 is further configured to sequentially input a value of a current row number counter and a currently calculated keyword into the plurality of hash functions to perform or operation, to obtain a result value corresponding to each hash function; the value of the row number counter is obtained based on accumulation calculation of a row number of each row of data; the data operation module 303 is further configured to obtain a vector composed of a plurality of parameter values corresponding to each row number after adjusting the parameter values in the multi-dimensional binary vector according to a preset assignment algorithm; the preset assignment algorithm includes: if there is a target parameter value in the plurality of parameter values corresponding to a row number, the target parameter value has a same value as a result value corresponding to any hash function in the plurality of hash functions, and the target parameter value is 0, the target parameter value is assigned as 1.

[0149] The searchable encryption management device provided in the application is applied to a proxy server in a searchable encryption management system, the searchable encryption management system further comprising a cloud server for storing encrypted data and a user device. First, a target data request sent by a target device is received, and database operations required to be performed by the proxy server and target data required to be operated are determined based on the target data request; the target device is any one of the cloud server and the user device; then, data operations corresponding to the database operations are performed on the target data based on keywords of the target data; wherein the database operations include any one of the following: data initialization operation, data query operation, data addition operation, data deletion operation and data update operation; the proxy server communicates with a plurality of cloud servers, and the proxy server generates encrypted data stored on each cloud server in the plurality of cloud servers; the encrypted data stored on each cloud server includes ciphertext data and a corresponding Bloom filter; the Bloom filter corresponding to the ciphertext data is calculated based on a plurality of hash functions; the ciphertext data is generated based on a reserved format encryption algorithm used by the proxy server; the proxy server stores a data encryption and decryption key of each cloud server and a data counter corresponding to each cloud server; the data counter is used to record the total number of rows of the encrypted data stored on each cloud server.

[0150] Figure 4 An example of a schematic diagram of a physical structure of an electronic device is shown in FIG. 1. Figure 4As shown, the electronic device can include a processor 410, a communications interface 420, a memory 430, and a communications bus 440, wherein the processor 410, the communications interface 420, and the memory 430 complete mutual communication through the communications bus 440. The processor 410 can invoke a logic instruction in the memory 430 to execute a searchable encryption management method, which includes an application server in a searchable encryption management system, the searchable encryption management system further including a cloud server for storing encrypted data and a user device. First, a target data request sent by a target device is received, and based on the target data request, a database operation required to be performed by the proxy server and target data required to be operated are determined; the target device is any one of the cloud server and the user device; then, a data operation corresponding to the database operation is performed on the target data based on a keyword of the target data; wherein the database operation includes any one of the following: data initialization operation, data query operation, data addition operation, data deletion operation, and data update operation; the proxy server communicates with a plurality of cloud servers, and the proxy server generates encrypted data stored on each cloud server in the plurality of cloud servers; the encrypted data stored by each cloud server includes ciphertext data and a corresponding Bloom filter; the Bloom filter corresponding to the ciphertext data is calculated based on a plurality of hash functions; the ciphertext data is generated based on a reserved format encryption algorithm used by the proxy server; the proxy server stores a data encryption and decryption key of each cloud server and a data counter corresponding to each cloud server; the data counter is used to record the total number of rows of encrypted data stored by each cloud server.

[0151] In addition, the logic instruction in the memory 430 described above can be implemented in the form of a software functional unit and sold or used as an independent product, which can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or part of the technical solutions can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a plurality of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in various embodiments of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0152] In another aspect, the present application also provides a computer program product, which comprises a computer program stored in a computer readable storage medium, the computer program comprising program instructions, when the program instructions are executed by a computer, the computer can perform the searchable encryption management method provided by each of the above methods, the method comprising: the proxy server applied to a searchable encryption management system, the searchable encryption management system further comprising: a cloud server for storing encrypted data, and a user device. First, receiving a target data request sent by a target device, and determining a database operation required to be performed by the proxy server and target data required to be operated based on the target data request; the target device is any one of the cloud server and the user device; then, performing a data operation corresponding to the database operation on the target data based on the keyword of the target data; wherein the database operation comprises any one of the following: data initialization operation, data query operation, data addition operation, data deletion operation and data update operation; the proxy server communicates with a plurality of cloud servers, and the proxy server generates encrypted data stored on each cloud server in the plurality of cloud servers; the encrypted data stored by each cloud server comprises: ciphertext data and a corresponding Bloom filter; the Bloom filter corresponding to the ciphertext data is calculated based on a plurality of hash functions; the ciphertext data is generated based on a reserved format encryption algorithm used by the proxy server; the proxy server stores: data encryption and decryption keys of each cloud server and data counters corresponding to each cloud server; the data counter is used to record the total number of rows of the encrypted data stored by each cloud server.

[0153] In yet another aspect, the present application also provides a computer readable storage medium having stored thereon a computer program, which, when executed by a processor, implements the searchable encryption management method provided above, which comprises: an agent server applied to a searchable encryption management system, the searchable encryption management system further comprising: a cloud server for storing encrypted data, and a user device. First, a target data request sent by a target device is received, and based on the target data request, a database operation required to be performed by the agent server and target data required to be operated are determined; the target device is any one of the cloud server and the user device; then, a data operation corresponding to the database operation is performed on the target data based on a keyword of the target data; wherein the database operation comprises any one of the following: data initialization operation, data query operation, data addition operation, data deletion operation and data update operation; the agent server communicates with a plurality of cloud servers, and the agent server generates encrypted data stored on each cloud server of the plurality of cloud servers; the encrypted data stored on each cloud server comprises: ciphertext data and a corresponding Bloom filter; the Bloom filter corresponding to the ciphertext data is calculated based on a plurality of hash functions; the ciphertext data is generated based on a reserved format encryption algorithm used by the agent server; the agent server stores: a data encryption and decryption key of each cloud server and a data counter corresponding to each cloud server; the data counter is used to record the total number of rows of the encrypted data stored on each cloud server.

[0154] The device embodiments described above are only schematic, wherein the units illustrated as separate components can or can not be physically separate, and the components illustrated as units can or can not be physical units, i.e., can be located in one place or distributed on a plurality of network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the embodiments. Those skilled in the art can understand and implement without creative labor.

[0155] From the above description of the embodiments, those skilled in the art can clearly understand that the embodiments can be implemented by means of software and necessary universal hardware platforms, and of course can also be implemented by hardware. Based on such understanding, the above technical solutions, essentially or in terms of the contribution to the prior art, can be embodied in the form of a software product. The computer software product can be stored in a computer readable storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, etc., and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0156] Finally, it should be noted that the above examples are only used to illustrate the technical solutions of the present application, and are not intended to limit the same; although the present application has been described in detail with reference to the foregoing examples, those of ordinary skill in the art should understand that they can still modify the technical solutions recorded in the foregoing examples, or make equivalent replacements for some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A searchable encrypted management method, characterized in that, A proxy server is used in a searchable encryption management system, which further includes a cloud server for storing encrypted data and user equipment. The method includes: The proxy server receives a target data request sent by the target device and determines the database operation to be performed and the target data to be operated on based on the target data request; the target device is either a cloud server or a user device. Based on the keywords of the target data, perform data operations on the target data corresponding to the database operations; The database operations include any one of the following: data initialization, data query, data addition, data deletion, and data update. The proxy server communicates with multiple cloud servers and generates encrypted data stored on each of the multiple cloud servers. The encrypted data stored on each cloud server includes ciphertext data and a corresponding Bloom filter. The Bloom filter corresponding to the ciphertext data is calculated based on multiple hash functions. The ciphertext data is generated based on a format-preserving encryption algorithm used by the proxy server. The proxy server stores the data encryption / decryption key for each cloud server and a data counter corresponding to each cloud server. The data counter records the total number of rows of encrypted data stored on each cloud server. The database operation is a data initialization operation initiated by the target cloud server; the target cloud server is any one of the plurality of cloud servers. The step of performing data operations on the target data based on keywords of the target data, corresponding to the database operations, includes: A preset keyword extraction algorithm is used to extract keywords corresponding to each plaintext data in the target data, generating a first data pair; the first data pair includes: plaintext data and a corresponding set of keywords; each plaintext data corresponds to at least one keyword; Based on the target key and target counter generated by the proxy server, a format-preserving encryption algorithm is used to generate ciphertext data corresponding to each plaintext data. Simultaneously, using the keyword set corresponding to each plaintext data as input, a Bloom filter generation algorithm is used to generate a Bloom filter corresponding to each plaintext data, resulting in a second data pair for each data item. The second data pair includes: ciphertext data and the corresponding Bloom filter. The value of the target counter is used to record the order of each plaintext data item among the multiple plaintext data items. The second data pair of each plaintext data is stored as encrypted data in the target cloud server in sequence, and the target key is stored as the encryption / decryption key of the target cloud server and the target counter is stored as the data counter of the target cloud server in the proxy server.

2. The method according to claim 1, characterized in that, The database operation is a data query operation initiated by the target user device; The step of performing data operations on the target data based on keywords of the target data, corresponding to the database operations, includes: The first keyword contained in the data requested by the user equipment is obtained, and the first keyword is used as input to generate a query vector corresponding to the first keyword using a Bloom filter generation algorithm; the query vector is a multidimensional binary vector. The query vector is sent to each cloud server, and the query data returned by the target cloud server is received. Based on the row number of each data and the data encryption / decryption key corresponding to the target cloud server, the encrypted data in the query data is decrypted using the decryption algorithm corresponding to the preserved format encryption algorithm to obtain plaintext data, and the plaintext data is sent to the user equipment; The target cloud server is a cloud server among the plurality of cloud servers that has a Bloom filter that matches the query vector; the query data includes: among the plurality of encrypted data stored in the target cloud server, at least one of the encrypted data has a Bloom filter that matches the query vector.

3. The method according to claim 1, characterized in that, The database operation is: a data addition operation initiated by the target user device; The step of performing data operations on the target data based on keywords of the target data, corresponding to the database operations, includes: Acquire at least one piece of newly added data to the target cloud server, and use a preset keyword extraction algorithm to extract keywords corresponding to each piece of plaintext data in the at least one piece of data, generating a third data pair; the third data pair includes: plaintext data and a corresponding set of keywords; each piece of plaintext data corresponds to at least one keyword; Based on the data encryption / decryption key and data counter of the target cloud server, a format-preserving encryption algorithm is used to generate ciphertext data corresponding to each plaintext data. At the same time, the keyword set corresponding to each plaintext data is used as input, and a Bloom filter generation algorithm is used to generate a Bloom filter corresponding to each plaintext data, resulting in a fourth data pair corresponding to each data. The fourth data pair includes: ciphertext data and the corresponding Bloom filter. After the encrypted data is stored on the target cloud server, the fourth data pair of each plaintext data is stored as encrypted data in the target cloud server in sequence.

4. The method according to claim 1, characterized in that, The database operation is: a data deletion operation initiated by the target user device; The step of performing data operations on the target data based on keywords of the target data, corresponding to the database operations, includes: The second keyword contained in the data requested for deletion by the user equipment is obtained, and the second keyword is used as the basis to generate a deletion vector using a Bloom filter algorithm; the deletion vector is a multidimensional binary vector. The deletion vector is sent to each cloud server respectively; The target cloud server is the cloud server among the plurality of cloud servers that has a Bloom filter that matches the deletion vector; after receiving the deletion vector, the target cloud server sets the value of the Bloom filter that matches the deletion vector in the plurality of encrypted data stored in the target cloud server to 0.

5. The method according to claim 1, characterized in that, The database operation is a data update operation jointly performed by the proxy server and the cloud server. The step of performing data operations on the target data based on keywords of the target data, corresponding to the database operations, includes: Obtain multiple encrypted data sent by the target cloud server and the old key corresponding to the target cloud server; A new key and a new counter corresponding to the target cloud server are generated, and the old key is used to decrypt the multiple encrypted data; the target cloud server is the cloud server among the multiple cloud servers that needs to be updated; during decryption, if the Bloom filter of the encrypted data is null, the plaintext data of the encrypted data is set to null. If the current plaintext data is not empty, then the current plaintext data is encrypted using a format-preserving encryption algorithm based on the new key, and the keyword set corresponding to the current plaintext data is used as input to generate a Bloom filter corresponding to the current plaintext data using a Bloom filter generation algorithm, and the new counter is updated. The encrypted data of each plaintext data is stored sequentially in the target cloud server, and the new key is stored in the proxy server as the encryption / decryption key of the target cloud server, and the new counter is stored in the proxy server as the data counter of the target cloud server.

6. The method according to any one of claims 2 to 5, characterized in that, The Bloom filter generation algorithm includes: Initialize the row count counter and the multidimensional binary vector; the multidimensional binary vector is used to represent multiple parameter values ​​corresponding to the row number of each row of data; the dimension of the multidimensional binary vector is the same as the number of rows of data stored on the cloud server; the number of parameter values ​​corresponding to the row number of each row of data is the same as the number of keywords in the ciphertext data corresponding to the row number; The current row count counter value and the currently calculated keyword are sequentially input into the plurality of hash functions for OR operation to obtain the result value corresponding to each hash function; the value of the row count counter is obtained by accumulating the row number of each row of data; After adjusting the parameter values ​​in the multidimensional binary vector according to the preset assignment algorithm, a vector consisting of multiple parameter values ​​corresponding to each row number is obtained. The preset assignment algorithm includes: if among the multiple parameter values ​​corresponding to the row number, there is a target parameter value whose parameter value number is the same as the result value corresponding to any of the multiple hash functions and whose parameter value is 0, then the target parameter value is assigned the value 1.

7. A searchable encrypted management device, characterized in that, A proxy server is used in a searchable encryption management system, which further includes a cloud server for storing encrypted data and user equipment. The device includes: The receiving module is used to receive target data requests sent by the target device; The determination module is used to determine the database operation that the proxy server needs to perform and the target data to be operated on based on the target data request; the target device is either a cloud server or a user device; The data manipulation module is used to perform data operations on the target data based on the keywords of the target data, corresponding to the database operations. The database operations include any one of the following: data initialization, data query, data addition, data deletion, and data update. The proxy server communicates with multiple cloud servers and generates encrypted data stored on each of the multiple cloud servers. The encrypted data stored on each cloud server includes ciphertext data and a corresponding Bloom filter. The Bloom filter corresponding to the ciphertext data is calculated based on multiple hash functions. The ciphertext data is generated based on a format-preserving encryption algorithm used by the proxy server. The proxy server stores the data encryption / decryption key for each cloud server and a data counter corresponding to each cloud server. The data counter records the total number of rows of encrypted data stored on each cloud server. The database operation is a data initialization operation initiated by the target cloud server; the target cloud server is any one of the plurality of cloud servers. The data operation module is specifically used to extract keywords corresponding to each plaintext data in the multiple plaintext data contained in the target data using a preset keyword extraction algorithm, and generate a first data pair; the first data pair includes: plaintext data and a corresponding set of keywords; each plaintext data corresponds to at least one keyword; The data operation module is further configured to generate ciphertext data corresponding to each plaintext data using a format-preserving encryption algorithm based on the target key and target counter generated by the proxy server; simultaneously, taking the keyword set corresponding to each plaintext data as input, generating a Bloom filter corresponding to each plaintext data using a Bloom filter generation algorithm, and obtaining a second data pair corresponding to each data; the second data pair includes: ciphertext data and the corresponding Bloom filter; the value of the target counter is used to record the order of each plaintext data in the plurality of plaintext data; The data operation module is further configured to sequentially store the second data pair of each plaintext data as encrypted data in the target cloud server, and to store the target key as the encryption / decryption key of the target cloud server and the target counter as the data counter of the target cloud server in the proxy server.

8. The apparatus according to claim 7, characterized in that, The database operation is a data query operation initiated by the target user device; The data operation module is specifically used to obtain the first keyword contained in the data requested by the user device, and use the first keyword as input to generate a query vector corresponding to the first keyword using a Bloom filter generation algorithm; the query vector is a multidimensional binary vector. The receiving module is also used to send the query vector to each cloud server respectively, and to receive the query data returned by the target cloud server; The data operation module is further configured to decrypt the encrypted data in the query data using a decryption algorithm corresponding to the format-preserving encryption algorithm, based on the row number of each data and the data encryption / decryption key corresponding to the target cloud server, to obtain plaintext data, and then send the plaintext data to the user equipment. The target cloud server is a cloud server among the plurality of cloud servers that has a Bloom filter that matches the query vector; the query data includes: among the plurality of encrypted data stored in the target cloud server, at least one of the encrypted data has a Bloom filter that matches the query vector.

9. The apparatus according to claim 7, characterized in that, The database operation is: a data addition operation initiated by the target user device; The data operation module is specifically used to acquire at least one piece of data newly added to the target cloud server, and use a preset keyword extraction algorithm to extract keywords corresponding to each piece of plaintext data in the at least one piece of data, generating a third data pair; the third data pair includes: plaintext data and a corresponding set of keywords; each piece of plaintext data corresponds to at least one keyword; The data operation module is further configured to generate ciphertext data corresponding to each plaintext data using a format-preserving encryption algorithm based on the data encryption / decryption key and data counter of the target cloud server. Simultaneously, it uses the keyword set corresponding to each plaintext data as input and generates a Bloom filter corresponding to each plaintext data using a Bloom filter generation algorithm, thus obtaining a fourth data pair corresponding to each data. The fourth data pair includes: ciphertext data and the corresponding Bloom filter. The data operation module is further configured to, in sequence, store the fourth data pair of each plaintext data as encrypted data in the target cloud server after the encrypted data stored therein.

10. The apparatus according to claim 7, characterized in that, The database operation is: a data deletion operation initiated by the target user device; The data operation module is specifically used to obtain the second keyword contained in the data requested for deletion by the user device, and use the second keyword as a Bloom filter generation algorithm to generate a deletion vector; the deletion vector is a multidimensional binary vector. The data operation module is further configured to send the deletion vector to each cloud server respectively; The target cloud server is the cloud server among the plurality of cloud servers that has a Bloom filter that matches the deletion vector; after receiving the deletion vector, the target cloud server sets the value of the Bloom filter that matches the deletion vector in the plurality of encrypted data stored in the target cloud server to 0.

11. The apparatus according to claim 7, characterized in that, The database operation is a data update operation jointly performed by the proxy server and the cloud server. The data operation module is specifically used to acquire multiple encrypted data sent by the target cloud server and the old key corresponding to the target cloud server. The data operation module is further configured to generate a new key and a new counter corresponding to the target cloud server, and to decrypt the multiple encrypted data using the old key; the target cloud server is the cloud server among the multiple cloud servers that needs to be updated; during decryption, if the Bloom filter of the encrypted data is null, the plaintext data of the encrypted data is set to null. The data operation module is further configured to, if the current plaintext data is not empty, encrypt the current plaintext data using a format-preserving encryption algorithm based on the new key, and use the keyword set corresponding to the current plaintext data as input to generate a Bloom filter corresponding to the current plaintext data using a Bloom filter generation algorithm, and update the new counter. The data operation module is further configured to sequentially store the encrypted data of each plaintext data into the target cloud server, and store the new key as the encryption / decryption key of the target cloud server and the new counter as the data counter of the target cloud server into the proxy server.

12. The apparatus according to any one of claims 7 to 11, characterized in that, The data operation module is specifically used to initialize the row counter and the multidimensional binary vector; the multidimensional binary vector is used to represent multiple parameter values ​​corresponding to the row number of each row of data; the dimension of the multidimensional binary vector is the same as the number of rows of data stored on the cloud server; the number of parameter values ​​corresponding to the row number of each row of data is the same as the number of keywords in the ciphertext data corresponding to the row number; The data operation module is further configured to sequentially input the value of the current row counter and the currently calculated keyword into the plurality of hash functions for OR operation, so as to obtain the result value corresponding to each hash function; the value of the row counter is obtained by accumulating the row number of each row of data. The data operation module is further configured to adjust the parameter values ​​in the multidimensional binary vector according to a preset assignment algorithm to obtain a vector consisting of multiple parameter values ​​corresponding to each row number. The preset assignment algorithm includes: if among the multiple parameter values ​​corresponding to the row number, there is a target parameter value whose parameter value number is the same as the result value corresponding to any of the multiple hash functions and whose parameter value is 0, then the target parameter value is assigned the value 1.

13. An electronic device, characterized in that, It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the steps of the searchable encryption management method as described in any one of claims 1 to 6.

14. A searchable encrypted management system, characterized in that, The system includes: a proxy server, a cloud server for storing encrypted data, and user equipment; the proxy server is used to perform the steps of the searchable encryption management method as described in any one of claims 1 to 6.

15. A computer-readable storage medium, characterized in that, It stores a computer program that, when executed by a processor, implements the steps of the searchable encryption management method as described in any one of claims 1 to 6.

Images